Bootkitty: Analyzing the first UEFI bootkit for Linux
Tags
cmtmf-attack-pattern: Develop Capabilities
maec-delivery-vectors: Watering Hole
attack-pattern: Data Bootkit - T1542.003 Code Signing Certificates - T1587.002 Code Signing Certificates - T1588.003 Develop Capabilities - T1587 Dynamic Linker Hijacking - T1574.006 Firmware - T1592.003 Hide Artifacts - T1628 Hide Artifacts - T1564 Hijack Execution Flow - T1625 Hijack Execution Flow - T1574 Hooking - T1617 Impair Defenses - T1562 Impair Defenses - T1629 Malware - T1587.001 Malware - T1588.001 Native Api - T1575 Pre-Os Boot - T1542 System Firmware - T1542.001 Bootkit - T1067 Execution Through Api - T1106 Execution Through Module Load - T1129 Hooking - T1179 Rootkit - T1014 System Firmware - T1019 Hooking Rootkit System Firmware
Show in Graph
Common Information
Type Value
UUID 9f1ae419-102e-45ad-ade2-1ef53b15d50c
Fingerprint ba3b991218ab39a7
Analysis status DONE
Considered CTI value 2
Text language
Published Nov. 27, 2024, midnight
Added to db Nov. 28, 2024, 1:25 p.m.
Last updated Dec. 4, 2024, 4:48 p.m.
Headline Bootkitty: Analyzing the first UEFI bootkit for Linux
Title Bootkitty: Analyzing the first UEFI bootkit for Linux
Detected Hints/Tags/Attributes 76/3/13
Source URLs
Redirection Url
Details Source https://www.welivesecurity.com/en/eset-research/bootkitty-analyzing-first-uefi-bootkit-linux/
URL Provider
Details Provider Source level domain
Details welivesecurity.com www.welivesecurity.com
Attributes
Details Type #Events CTI Value
Details Domain 5 
injector.so
Details Domain 117 
eset.com
Details Domain 2 
rootkit.agent.fm
Details Email 72 
threatintel@eset.com
Details MITRE ATT&CK Techniques 101 
T1587.001
Details MITRE ATT&CK Techniques 17 
T1587.002
Details MITRE ATT&CK Techniques 241 
T1106
Details MITRE ATT&CK Techniques 126 
T1129
Details MITRE ATT&CK Techniques 18 
T1574.006
Details MITRE ATT&CK Techniques 10 
T1542.003
Details MITRE ATT&CK Techniques 46 
T1014
Details MITRE ATT&CK Techniques 239 
T1562
Details MITRE ATT&CK Techniques 113 
T1564